Secret rotation interval remediation

Using Console

To remediate the issue of Secrets Manager secrets not being rotated frequently in AWS using the AWS console, follow these steps:

Open the AWS Secrets Manager console.
Select the secret that needs to be rotated.
Click on the “Rotation” tab.
Click on the “Edit rotation” button.
In the “Configure rotation” section, select the rotation frequency and the number of days to keep the previous version of the secret.
Click on the “Enable rotation” checkbox.
Choose the Lambda function or AWS Secrets Manager to rotate the secret.
Click on the “Save changes” button.

By following these steps, the Secrets Manager secret will be automatically rotated according to the selected frequency, and the previous versions of the secret will be kept for the specified number of days.

Using CLI

To remediate the misconfiguration of Secrets Manager Secrets not being rotated frequently in AWS using AWS CLI, follow these steps:

Open the AWS CLI on your local machine.
Run the following command to list all the secrets available in the Secrets Manager service:

aws secretsmanager list-secrets

Identify the secret that needs to be rotated frequently.
Run the following command to rotate the secret:

aws secretsmanager rotate-secret --secret-id <secret-id>

Note: Replace <secret-id> with the ID of the secret that needs to be rotated.

After running the above command, the Secrets Manager service will create a new version of the secret and update the old version with a new password or other credentials.
Update the applications or services that use the secret with the new credentials.
Delete the old version of the secret using the following command:

aws secretsmanager delete-secret --secret-id <secret-id> --force-delete-without-recovery

Note: Replace <secret-id> with the ID of the old version of the secret.

Repeat the above steps periodically to ensure that secrets are rotated frequently. It is recommended to set up automated rotation using AWS Lambda or other automation tools.

Using Python

To remediate the issue of Secrets Manager Secrets not being rotated frequently in AWS, you can use the following steps using Python:

Import the Boto3 library for AWS:

import boto3

Create an AWS Secrets Manager client:

client = boto3.client('secretsmanager')

Get a list of all secrets in AWS Secrets Manager:

secrets = client.list_secrets()

Loop through the list of secrets and check if each secret has been rotated within the last 30 days:

for secret in secrets['SecretList']:
    if 'RotationRules' in secret:
        rotation_days = secret['RotationRules']['AutomaticallyAfterDays']
        last_rotated_date = secret['LastRotatedDate']
        if (datetime.now() - last_rotated_date).days > rotation_days:
            # Secret has not been rotated within the last 30 days
            # Code to rotate the secret goes here

If a secret has not been rotated within the last 30 days, use the rotate_secret function to rotate the secret:

client.rotate_secret(SecretId=secret['ARN'])

Add logging and error handling to the script as needed.
Schedule the script to run on a regular basis (e.g. daily) using AWS Lambda or a cron job.

By following these steps, you can ensure that all secrets in AWS Secrets Manager are rotated frequently, which helps to improve the security of your AWS environment.

Using Terraform

resource "aws_secretsmanager_secret" "this" {
  name        = "SECRET_NAME"        # replace with your secret name
  description = "SECRET_DESCRIPTION" # replace with your description
}

# Enable or configure automatic rotation for the secret using a Lambda function
resource "aws_secretsmanager_secret_rotation" "this" {
  secret_id           = aws_secretsmanager_secret.this.id
  rotation_lambda_arn = "ROTATION_LAMBDA_ARN" # replace with the ARN of your rotation Lambda

  rotation_rules {
    automatically_after_days = 90 # adjust to meet your organization's policy
  }
}

This requires that ROTATION_LAMBDA_ARN already exists and has the correct IAM permissions for rotation; Terraform will fail to apply if the Lambda cannot be invoked by Secrets Manager. This configuration is update-in-place and does not force replacement of the secret.Verification: terraform plan should show creation (or update) of aws_secretsmanager_secret_rotation.this with rotation_lambda_arn = "ROTATION_LAMBDA_ARN" and rotation_rules.0.automatically_after_days = 90.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Secret rotation interval remediation

Triage and Remediation

Remediation

​Triage and Remediation

​Remediation

​

Triage and Remediation

Remediation